Privacy Policy
Last updated: October 14, 2026
Effective date: October 14, 2026
Carbon Hosting ("Carbon Hosting", "we", "us", "our") operates carbonhosting.xyz and hosts Minecraft game servers for customers. This Privacy Policy explains what information we collect, why, how long we keep it, and the rights you have. It is part of our Terms of Service.
1. Scope
1.1 This policy covers the public website, the client area, the game panel, billing, support through the client area and Discord, and the operation of customer game servers on our hardware.
1.2 Our services are directed at the United States. If you use them from the European Union, the European Economic Area, the United Kingdom, or anywhere else, this policy, including the EU and California sections below, sets out how we handle your personal information.
2. Information we collect
2.1 Account information: when you register, we collect your email address, name if you provide it, and a password stored as a cryptographic hash.
2.2 Billing information: payments are processed by Stripe, Inc. We do not receive or store your full card number. Stripe shares with us your billing name, email, payment status, transaction identifiers, and the last digits and brand of the payment method. If you enter tax or VAT details, those are collected at checkout.
2.3 Service data: the contents of your game server, including your files, configuration, logs, and backups, plus the panel data needed to run your service (limits, ports, allocations).
2.4 Technical and usage data: IP address, user agent, timestamps, and request logs from the website, client area, and panel, kept for security and service quality.
2.5 Cookies and local storage: we use strictly necessary cookies on our website, client area, and panel for sessions and login state. We do not use advertising, cross-site tracking, or profiling cookies. If we later add optional analytics that need cookies, they run only with your consent where consent is required, and we will describe them in a cookie policy published on this site.
2.6 Support data: messages you send us through the ticket system in your client area, and through our official Discord community.
2.7 We do not collect information from children under 13 (see section 10).
3. How and why we use information
3.1 To provide the services you bought: hosting your game server, running the panel, billing and renewals, and supporting you (legal basis: performance of our contract with you; necessary for entering or performing a contract under EU GDPR Article 6(1)(b)).
3.2 To keep the service secure and to detect abuse: log analysis, rate limiting, fraud prevention, and enforcing our Terms and Acceptable Use Policy (legal basis: performance of contract and our legitimate interests in security and abuse prevention under Article 6(1)(f)).
3.3 To comply with law: tax and accounting records, lawful responses to legal requests and copyright processes (legal basis: legal obligation under Article 6(1)(c), and legitimate interests).
3.4 For service communications: invoices, renewal reminders, suspension notices, and material changes to the service or policies (legal basis: contract, and legitimate interests).
3.5 For optional marketing with your consent: newsletters or product news, where you chose to receive them (legal basis: consent under Article 6(1)(a); you can withdraw consent at any time). We do not send marketing to accounts that did not opt in.
3.6 We do not sell personal information, and we do not use tracking for cross-site advertising or profiling of minors in any case.
4. Sharing and subprocessors
4.1 We share personal information only with the providers needed to run the business, and never for sale.
4.2 Current subprocessors:
| Provider | Purpose |
|---|---|
| Stripe, Inc. | Payment processing and billing records |
| Cloudflare, Inc. | Domain name service and traffic protection |
| Discord Inc. | Customer support and community, via your use of our server |
| OVH US LLC | Dedicated bare metal server provider: physical machine, datacenter, and network for our services, United States |
4.3 Transactional email (for example, invoices and notices) is sent from our own systems today. If we later add an email delivery provider, we list it here with notice. We sign data processing agreements with providers where required by EU GDPR, and we may add providers to this list with notice for new functionality; we keep this list current.
4.4 We may also disclose information where required by law, court order, or lawful government request, or to protect the rights, property, or safety of our customers, us, or others (for example, in responding to a valid copyright notice process described in our DMCA Policy at /dmca).
5. International transfers
5.1 Our operations are based in the United States. If you request our services from the EU, EEA, or UK, your information will be transferred to the United States and processed there.
5.2 For personal information protected by EU GDPR or the UK GDPR, transfers to the United States are made pursuant to appropriate safeguards, which we implement through the European Commission's Standard Contractual Clauses (and the UK Addendum where applicable) with our subprocessors, together with supplementary measures as needed.
5.3 You may request details of the safeguards used for your data by contacting us (section 12).
6. Retention
6.1 Account records remain while your account is active.
6.2 Server files and configuration stay while a service is active plus seven (7) days after cancellation or termination, then are permanently deleted (see our Terms of Service).
6.3 Billing and invoice records are kept as long as required by tax and accounting law, commonly seven (7) years in the United States after the fiscal year they relate to.
6.4 Security and network logs are kept for up to ninety (90) days.
6.5 Support tickets are kept for up to twenty-four (24) months after closure; Discord messages are not retained by us beyond what remains in the Discord server itself.
6.6 Backups are overwritten on the published schedule; erasure requests apply to live systems and to scheduled backup cycles as they expire.
7. Security
7.1 We run a hardened, single-machine service: least access for staff, encrypted transport (TLS) for the site, panel, and game connections, hashed credentials, and backups. No system is perfectly secure. If you find a weakness, report it privately by email to [email protected] (see also our Acceptable Use Policy).
7.2 Card data security is handled by Stripe under its compliance programs; we do not store full card numbers.
8. EU GDPR rights
8.1 If you are in the EU, EEA, or UK, you have the following rights over your personal information:
| Right | What it means |
|---|---|
| Access | Ask for a copy and confirmation of what we process about you |
| Rectification | Ask us to correct inaccurate information |
| Erasure | Ask us to delete your information where no overriding legal basis applies |
| Restriction | Ask us to restrict processing while a dispute or correction is pending |
| Portability | Receive your account and billing data in a structured, commonly used, machine-readable format, or have it transmitted to another provider where technically feasible |
| Objection | Object to processing based on our legitimate interests; and always object to direct marketing |
| Withdraw consent | Where we rely on consent (marketing, optional cookies), withdraw at any time without affecting prior lawful processing |
8.2 To exercise any right, email [email protected], or open a ticket in your client area. We verify your identity where needed and respond within one month of receiving a complete request.
8.3 You also have the right to lodge a complaint with your national supervisory authority. We ask that you contact us first so we can try to resolve the matter directly.
8.4 For UK residents, our rights description applies equally, and the UK Information Commissioner's Office is the relevant regulator.
9. California rights
9.1 California residents have certain rights under the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA/CPRA"), where it applies to us: rights to know, delete, and correct personal information; to limit the use of sensitive personal information; to opt out of sale or sharing; and to be free of discrimination for exercising rights.
9.2 We do not sell or share personal information as defined by the CCPA/CPRA, and we have no process for third-party marketing use of your data. As a small business we may currently fall below CCPA coverage thresholds; whether or not we are covered, we extend the practical rights above: you may request the categories and specific pieces of personal information we hold about you, request correction or deletion, and ask how it is used and shared.
9.3 To exercise rights, email [email protected], or open a ticket in your client area. We verify your request. You may authorize an agent, subject to our verification of both the agent and the authorization.
9.4 Shine the Light disclosure: California Civil Code section 1798.83 allows residents to request a list of the categories of personal information disclosed to third parties for their direct marketing purposes in the prior year. We do not disclose personal information to third parties for their direct marketing purposes.
9.5 California Automatic Renewal Law: your subscription terms, price, and cancellation method are described in sections 5 through 7 of our Terms of Service, and those disclosures and the cancellation flow are provided in the client area at signup and renewal.
9.6 California residents under age 18: we do not knowingly provide our services to users under 13, and users 13 through 17 require parental consent; a minor who registered may contact us to remove information they posted while underage.
10. Children's privacy
10.1 Our services are not directed to children under 13 and we do not knowingly collect personal information from anyone under 13, consistent with the United States Children's Online Privacy Protection Act ("COPPA").
10.2 Users aged 13 through 17 may use services only under the supervision of a parent or legal guardian who holds the account (see section 3 of our Terms of Service). The parent or guardian controls the account data and can request its deletion.
10.3 If you believe a child under 13 gave us personal information, contact us at [email protected] and we will delete it promptly.
11. Breach notification
11.1 If a personal data breach affects your information, we will notify affected customers and, where required, supervisory authorities within the timelines required by applicable law, with a description of the breach, the information involved, and the measures taken.
12. Contact
12.1 Contact for all privacy matters, including EU and California rights requests:
- Carbon Hosting, Privacy
- Email: [email protected]
- Client area tickets: open a ticket from your client area at carbonhosting.xyz
- If you need our postal address for a legal notice, request it by email and we will provide it
12.2 Questions about this policy are answered through the ticket system in your client area or through our official Discord community.
13. Changes
13.1 We post changes here and update the date in the Last updated line at the top of this document. Material changes that reduce your rights are notified to active customers by email at least fourteen (14) days before taking effect, as described in our Terms of Service.